stage-350: medium-risk batch — auth trilogy (#2191/2/3) + cancel-status #2151 with conflict resolution + #2178 ollama guard + #2204 provider precedence + #2203 activity animation#2209

Merged

nesquena-hermes merged 36 commits into

May 13, 2026

Commits on May 12, 2026

Commits on May 13, 2026

Cache PBKDF2 password hash to eliminate ~1s overhead on every HTTP request
lucasrc
committed
Cache PBKDF2 password hash to eliminate ~1s overhead on every HTTP request
lucasrc
committed
fix(ui): Fix the issue where custom models are not displayed in the model configuration list
hualong1009
committed
feat: soften sweep edges and widen band for Activity animation
dobby-d-elf
committed
save
dobby-d-elf
committed
fix(auth): thread-safe login rate limiter, PBKDF2 key separation, and migration path

lucasrc
and
claude
committed
Version A: tune Activity sweep animation
dobby-d-elf
committed
Version B: use gold Activity highlight sweep
dobby-d-elf
committed
fix(auth): cache signing and PBKDF2 keys in memory, remove migration side-effect call
lucasrc
committed
Refine version B Activity highlight sweep
dobby-d-elf
committed
Widen version B Activity highlight sweep
dobby-d-elf
committed
fix(auth): tighten except to OSError, add type hints, fix test imports
lucasrc
committed
fix(auth): correct misleading cache invalidation comment in verify_password()
lucasrc
committed
fix(auth): invalidate password hash cache in save_settings() on password change
lucasrc
committed
test(auth): add cache invalidation regression tests for save_settings()
lucasrc
committed
fix(auth): HMAC length migration bridge and restore Secure cookie heuristic

lucasrc
and
claude
committed
docs(auth): add X-Forwarded-Proto trust warning to _is_secure_context()
lucasrc
committed
fix(auth): add type hint to verify_session()
lucasrc
committed
test(auth): add regression tests for HMAC migration bridge (32→64 char)
lucasrc
committed
fix(auth): update HMAC sig length assertion to 64 chars and rebase on PR1
lucasrc
committed
Polish version B Activity highlight sweep
dobby-d-elf
committed
Merge remote-tracking branch 'origin/master' into tools-animation-version-b
dobby-d-elf
committed
Fix opencode-go provider overlap routing
Michaelyklam
committed
test(auth): merge invalidation tests into hash cache test file, remove duplicate
lucasrc
committed
Merge pull request #2204 into stage-350
Hermes Agent
committed
Merge pull request #2203 into stage-350
Hermes Agent
committed
Merge pull request #2191 into stage-350
Hermes Agent
committed
Merge pull request #2193 into stage-350
Hermes Agent
committed
Merge pull request #2192 into stage-350
Hermes Agent
committed
Merge pull request #2151 into stage-350
Hermes Agent
committed
Merge pull request #2178 into stage-350
Hermes Agent
committed
stage-350: fix #2178 CI — update Ollama test assertion to match new allowOllamaFormat guard
Hermes Agent
committed
docs: CHANGELOG stage-350 — close v0.51.56, open Unreleased for 7-PR medium-risk batch
Hermes Agent
committed
stage-350: apply Opus SHOULD-FIX — tighten _partial_already_present dedup scope
Hermes Agent
committed